Analysis

  • max time kernel
    31s
  • max time network
    32s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 02:05

General

  • Target

    Sage Bootstrapper.exe

  • Size

    11.5MB

  • MD5

    733761dacdb4368abae431b6b3c294ed

  • SHA1

    c5cb074c31093b7a451579aae143ea80b2686a2d

  • SHA256

    c23749a6afc68eaa38e330b4967ce18cc624cdb6f313799a454c4ad6a0c0d543

  • SHA512

    3ffc8550743c81d51fbca6e9862012fd251aa5fa964356f23c98f1769f1e85e7706ce6c4b0c5e2ef4a3f6d7939882ec6ad908fa73bb2053d2bc6c30e47e60ddf

  • SSDEEP

    196608:8jXU3v+ZJSBoj0NuEP01ABUAw2VU/KuQ0zMV2U1qhaxPZl8:2XU3v+JWoj0I+0tn5vzMV22RP

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sage Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Sage Bootstrapper.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4772-0-0x00007FF7C85E9000-0x00007FF7C8CDB000-memory.dmp

    Filesize

    6.9MB

  • memory/4772-2-0x00007FF9A87E0000-0x00007FF9A87E2000-memory.dmp

    Filesize

    8KB

  • memory/4772-5-0x00007FF9A8810000-0x00007FF9A8812000-memory.dmp

    Filesize

    8KB

  • memory/4772-4-0x00007FF9A8800000-0x00007FF9A8802000-memory.dmp

    Filesize

    8KB

  • memory/4772-3-0x00007FF9A87F0000-0x00007FF9A87F2000-memory.dmp

    Filesize

    8KB

  • memory/4772-1-0x00007FF9A87D0000-0x00007FF9A87D2000-memory.dmp

    Filesize

    8KB

  • memory/4772-11-0x00007FF9A8860000-0x00007FF9A8862000-memory.dmp

    Filesize

    8KB

  • memory/4772-17-0x00007FF9A88C0000-0x00007FF9A88C2000-memory.dmp

    Filesize

    8KB

  • memory/4772-16-0x00007FF9A88B0000-0x00007FF9A88B2000-memory.dmp

    Filesize

    8KB

  • memory/4772-15-0x00007FF9A88A0000-0x00007FF9A88A2000-memory.dmp

    Filesize

    8KB

  • memory/4772-14-0x00007FF9A8890000-0x00007FF9A8892000-memory.dmp

    Filesize

    8KB

  • memory/4772-9-0x00007FF9A8840000-0x00007FF9A8842000-memory.dmp

    Filesize

    8KB

  • memory/4772-8-0x00007FF9A8830000-0x00007FF9A8832000-memory.dmp

    Filesize

    8KB

  • memory/4772-13-0x00007FF9A8880000-0x00007FF9A8882000-memory.dmp

    Filesize

    8KB

  • memory/4772-10-0x00007FF9A8850000-0x00007FF9A8852000-memory.dmp

    Filesize

    8KB

  • memory/4772-7-0x00007FF7C85C0000-0x00007FF7C9865000-memory.dmp

    Filesize

    18.6MB

  • memory/4772-6-0x00007FF9A8820000-0x00007FF9A8822000-memory.dmp

    Filesize

    8KB

  • memory/4772-20-0x00007FF9A88F0000-0x00007FF9A88F2000-memory.dmp

    Filesize

    8KB

  • memory/4772-19-0x00007FF9A88E0000-0x00007FF9A88E2000-memory.dmp

    Filesize

    8KB

  • memory/4772-18-0x00007FF9A88D0000-0x00007FF9A88D2000-memory.dmp

    Filesize

    8KB

  • memory/4772-12-0x00007FF9A8870000-0x00007FF9A8872000-memory.dmp

    Filesize

    8KB

  • memory/4772-22-0x000001CE72830000-0x000001CE72844000-memory.dmp

    Filesize

    80KB

  • memory/4772-21-0x00007FF9A8900000-0x00007FF9A8902000-memory.dmp

    Filesize

    8KB

  • memory/4772-29-0x00007FF7C85C0000-0x00007FF7C9865000-memory.dmp

    Filesize

    18.6MB

  • memory/4772-30-0x00007FF7C85E9000-0x00007FF7C8CDB000-memory.dmp

    Filesize

    6.9MB